|
 |
7478b7e |
From: Jason Wang <jasowang@redhat.com>
|
|
|
7478b7e |
Date: Thu, 23 Mar 2017 13:07:16 +0800
|
|
|
7478b7e |
Subject: [PATCH] virtio_pci: fix out of bound access for msix_names
|
|
|
7478b7e |
|
|
|
7478b7e |
---
|
|
|
7478b7e |
drivers/virtio/virtio_pci_common.c | 9 +++++----
|
|
|
7478b7e |
1 file changed, 5 insertions(+), 4 deletions(-)
|
|
|
7478b7e |
|
|
|
7478b7e |
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
|
|
|
7478b7e |
index df548a6..5905349 100644
|
|
|
7478b7e |
--- a/drivers/virtio/virtio_pci_common.c
|
|
|
7478b7e |
+++ b/drivers/virtio/virtio_pci_common.c
|
|
|
7478b7e |
@@ -147,7 +147,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
|
|
|
7478b7e |
{
|
|
|
7478b7e |
struct virtio_pci_device *vp_dev = to_vp_device(vdev);
|
|
|
7478b7e |
const char *name = dev_name(&vp_dev->vdev.dev);
|
|
|
7478b7e |
- int i, err = -ENOMEM, allocated_vectors, nvectors;
|
|
|
7478b7e |
+ int i, j, err = -ENOMEM, allocated_vectors, nvectors;
|
|
|
7478b7e |
unsigned flags = PCI_IRQ_MSIX;
|
|
|
7478b7e |
bool shared = false;
|
|
|
7478b7e |
u16 msix_vec;
|
|
|
7478b7e |
@@ -212,7 +212,7 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
|
|
|
7478b7e |
if (!vp_dev->msix_vector_map)
|
|
|
7478b7e |
goto out_disable_config_irq;
|
|
|
7478b7e |
|
|
|
7478b7e |
- allocated_vectors = 1; /* vector 0 is the config interrupt */
|
|
|
7478b7e |
+ allocated_vectors = j = 1; /* vector 0 is the config interrupt */
|
|
|
7478b7e |
for (i = 0; i < nvqs; ++i) {
|
|
|
7478b7e |
if (!names[i]) {
|
|
|
7478b7e |
vqs[i] = NULL;
|
|
|
7478b7e |
@@ -236,18 +236,19 @@ static int vp_find_vqs_msix(struct virtio_device *vdev, unsigned nvqs,
|
|
|
7478b7e |
continue;
|
|
|
7478b7e |
}
|
|
|
7478b7e |
|
|
|
7478b7e |
- snprintf(vp_dev->msix_names[i + 1],
|
|
|
7478b7e |
+ snprintf(vp_dev->msix_names[j],
|
|
|
7478b7e |
sizeof(*vp_dev->msix_names), "%s-%s",
|
|
|
7478b7e |
dev_name(&vp_dev->vdev.dev), names[i]);
|
|
|
7478b7e |
err = request_irq(pci_irq_vector(vp_dev->pci_dev, msix_vec),
|
|
|
7478b7e |
vring_interrupt, IRQF_SHARED,
|
|
|
7478b7e |
- vp_dev->msix_names[i + 1], vqs[i]);
|
|
|
7478b7e |
+ vp_dev->msix_names[j], vqs[i]);
|
|
|
7478b7e |
if (err) {
|
|
|
7478b7e |
/* don't free this irq on error */
|
|
|
7478b7e |
vp_dev->msix_vector_map[i] = VIRTIO_MSI_NO_VECTOR;
|
|
|
7478b7e |
goto out_remove_vqs;
|
|
|
7478b7e |
}
|
|
|
7478b7e |
vp_dev->msix_vector_map[i] = msix_vec;
|
|
|
7478b7e |
+ j++;
|
|
|
7478b7e |
|
|
|
7478b7e |
/*
|
|
|
7478b7e |
* Use a different vector for each queue if they are available,
|
|
|
7478b7e |
--
|
|
|
7478b7e |
2.7.4
|
|
|
7478b7e |
|
|
|
7478b7e |
|